Bug 13232

Summary: panic("rtfree"); when sending bootp requests to machine
Product: Base System Reporter: colle <colle>
Component: kernAssignee: Ceri Davies <ceri>
Status: Closed FIXED    
Severity: Affects Only Me    
Priority: Normal    
Version: 3.2-RELEASE   
Hardware: Any   
OS: Any   

Description colle 1999-08-18 20:10:01 UTC
Machine crashes when sending bootp-packets to a machine,
without a defaultroute and where the entry for the bootpclient 
is not complete (incomplete in the sense that the hostname could not
be resolved to a valid ip-address)

Fix: 

temporary fix: add a default route, or make sure you don't mistype
hostnames ;-)
How-To-Repeat: 1) enable bootp-service in /etc/inetd
2) create the following /etc/bootptab
mopie:ha=0000e8543231:bf=init:dn=test.net:ds=192.168.1.1:rp=/usr/path:sa=192.168.1.1
3) make sure 'mopie' cannot be resolved
4) delete default route:   route delete default
5) let bootpclient mopie send some bootprequests
and enjoy the core  ;-)

I've seen the same behavior for FreeBD-2.2.6 and FreeBSD-4.0-19990307-SNAP
Comment 1 hatanaka 1999-09-16 03:06:19 UTC
Altough I am not sure to fix, you can try the following fixes.
Hope that helps.

-Massa. Hatanaka

==
[1] For aged bug

    route_output():sys/net/rtsock.c

		if ((rnh = rt_tables[dst->sa_family]) == 0) {
			senderr(EAFNOSUPPORT);
		} else if (rt = (struct rtentry *)
				rnh->rnh_lookup(dst, netmask, rnh))
	#ifdef	notdef
			rt->rt_refcnt++;
	#else   /* notdef */
		{
			if (rt->rt_nodes[0].rn_flags & RNF_ROOT) {
				rt = 0;
				senderr(ESRCH);
			}
			rt->rt_refcnt++;
		}
	#endif  /* notdef */
		else
			senderr(ESRCH);

[2] For young bug

    in_matroute():sys/netinet/in_rmx.c

	static struct radix_node *
	in_matroute(void *v_arg, struct radix_node_head *head)
	{
		struct radix_node *rn = rn_match(v_arg, head);
		struct rtentry *rt = (struct rtentry *)rn;

#ifdef  notdef
#endif  /* notdef */
		if (rn && (rn->rn_flags & RNF_ROOT)) {
			return (rn);
		}
#endif  /* notdef */
		if(rt && rt->rt_refcnt == 0) { /* this is first reference */
			if(rt->rt_flags & RTPRF_OURS) {
				rt->rt_flags &= ~RTPRF_OURS;
				rt->rt_rmx.rmx_expire = 0;
			}
		}
		return rn;
	}

===
Massa. Hatanaka                                Fujitsu Limited, Japan
/* E-Mail: masoh@itspf.fujitsu.oz.au */
E-Mail: hatanaka@open.nm.fujitsu.co.jp
Comment 2 colle 1999-09-22 07:12:59 UTC
Hi,

I patched the kernel with this updated, and now it seems to work
fine...
Thanks!

cc

On Thu, 16 Sep 1999, Massa.Hatanaka wrote:

> Date: Thu, 16 Sep 1999 11:06:18 JST
> From: Massa.Hatanaka <hatanaka@open.nm.fujitsu.co.jp>
> To: freebsd-gnats-submit@freebsd.org
> Cc: colle@krtkg1.rug.ac.be, hatanaka@open.nm.fujitsu.co.jp
> Subject: Re: kern/13232: panic("rtfree"); when sending bootp requests to
    machine
> 
> Altough I am not sure to fix, you can try the following fixes.
> Hope that helps.
> 
> -Massa. Hatanaka
> 
> ==
> [1] For aged bug
> 
>     route_output():sys/net/rtsock.c
> 
> 		if ((rnh = rt_tables[dst->sa_family]) == 0) {
> 			senderr(EAFNOSUPPORT);
> 		} else if (rt = (struct rtentry *)
> 				rnh->rnh_lookup(dst, netmask, rnh))
> 	#ifdef	notdef
> 			rt->rt_refcnt++;
> 	#else   /* notdef */
> 		{
> 			if (rt->rt_nodes[0].rn_flags & RNF_ROOT) {
> 				rt = 0;
> 				senderr(ESRCH);
> 			}
> 			rt->rt_refcnt++;
> 		}
> 	#endif  /* notdef */
> 		else
> 			senderr(ESRCH);
> 
> [2] For young bug
> 
>     in_matroute():sys/netinet/in_rmx.c
> 
> 	static struct radix_node *
> 	in_matroute(void *v_arg, struct radix_node_head *head)
> 	{
> 		struct radix_node *rn = rn_match(v_arg, head);
> 		struct rtentry *rt = (struct rtentry *)rn;
> 
> #ifdef  notdef
> #endif  /* notdef */
> 		if (rn && (rn->rn_flags & RNF_ROOT)) {
> 			return (rn);
> 		}
> #endif  /* notdef */
> 		if(rt && rt->rt_refcnt == 0) { /* this is first reference */
> 			if(rt->rt_flags & RTPRF_OURS) {
> 				rt->rt_flags &= ~RTPRF_OURS;
> 				rt->rt_rmx.rmx_expire = 0;
> 			}
> 		}
> 		return rn;
> 	}
> 
> ===
> Massa. Hatanaka                                Fujitsu Limited, Japan
> /* E-Mail: masoh@itspf.fujitsu.oz.au */
> E-Mail: hatanaka@open.nm.fujitsu.co.jp
> 

---

you type win, but you lose

The Internet doesn't really need admins that are dumber than 
the ones we have already.
----

Christophe Colle

Telenet, Liersesteenweg 4, 2800 Mechelen, Belgium
    tel:+32(0)15.333.981
    mailto:christophe.colle@telenet.be
    http://krtkg1.rug.ac.be/~colle
Comment 3 iedowse freebsd_committer freebsd_triage 2001-11-16 22:28:39 UTC
State Changed
From-To: open->feedback


Hi, do you know if this problem still exists in FreeBSD? The 
particular code doesn't seem to have changed since, so I suspect 
the bug is still there?
Comment 4 Ceri Davies freebsd_committer freebsd_triage 2003-06-08 19:00:42 UTC
State Changed
From-To: feedback->closed

Feedback timeout (6 months or more). 
I will handle any feedback that this closure generates. 


Comment 5 Ceri Davies freebsd_committer freebsd_triage 2003-06-08 19:00:42 UTC
Responsible Changed
From-To: freebsd-bugs->ceri

Feedback timeout (6 months or more). 
I will handle any feedback that this closure generates.